pwnhard

Astralogy

kalmarctf2026

Task: Hobby OS (Astral OS) kernel exploitation under QEMU with SMEP, patched pread/pwrite. Solution: Find iovec_user_check() bug in readv/writev that skips validation when first iovec has len=0, use pipe-based kernel read/write to overwrite process credentials for privilege escalation.

$ ls tags/ techniques/

privilege_escalation qemu kernel osdev iovec data_only_exploit arbitrary_read_write cred_overwrite hobby_os

iovec_validation_bypasskernel_arbitrary_read_writepipe_based_kernel_rwcredential_overwritedata_only_kernel_exploit

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub to get started.

$ssh [email protected]